U
    lHJe#                     @   sp  d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlmZm	Z	m
Z
mZmZmZmZ d dlmZmZmZmZmZmZ d dlmZ d dlmZmZ d dlmZmZ d d	lmZm Z m!Z! d d
l"m#Z# d dl$m%Z% d dl&m'Z' d dl(m)Z)m*Z* d dl+m,Z, d dl-m.Z. d dl/m0Z0 d dl1m2Z2 dZ3dZ4dZ5dZ6dZ7edde8fde8fgZ9edde:fde
e9 fdee8 fde:fgZ;edd e8fd!e8fd"e8fgZ<ed#d$e:fd%ee8 fgZ=G d&d' d'ej>Z?ed(d$e?fdee
e9  fgZ@G d)d* d*e0jAZBG d+d, d,ZCG d-d. d.ZDG d/d0 d0ZEe	e8e	e8e8f f d1d2d3ZFe
eE e	e8e:f e	e8e	e8e	e8e8f f f d4d5d6ZGd7d8 ZHe8eee? ee8 f d9d:d;ZIeDe
eE e8e	e8e	e8e8f f e#e	e8e:f e:e?d<d=d>ZJeEe
eE e8e	e8e	e8e8f f e#e	e8e:f e:e:e?d?	d@dAZKde#e8e:e:e?dCdDdEZLdFdG ZMdHdI ZNeEe	e8e	e8e8f f e	e8eCf dJdKdLZOeDe	e8e	e8e8f f e	e8eCf dMdNdOZPe8e	e8eCf dPdQdRZQeCe	e8e	e8e8f f eCdSdTdUZRdVdW ZSe
ee8eCf  eTeTe8dXdYdZZUe8e#d[d\d]ZVe8e#e:d^d_d`ZWde?e8e8dbdcddZXe#e	e8e
ee8eCf  f e	e8e
e< f eTeTe:e;dedfdgZYe
e9 e8dhdidjZZe#e8e	e8eCf e	e8e	e8e8f f e	e8e	e8e	e8e8f f f e:e@dkdldmZ[dd1dndoZ\e#e8e:dpdqdrZ]e#dsdtduZ^e#e:dvdwdxZ_e#e8e:dydzd{Z`e#e:e:d|d}d~Zae8e#e:e:dddZbe#e:dvddZce	e8ef e#e:e:dddZde#e
e8 e8e:e=dddZedS )    N)defaultdict)datetime)AnyDictList
NamedTupleOptionalSetTuple)apt
exceptions	livepatchmessagessystemutil)	_initiate)MagicAttachRevokeOptions_revoke)MagicAttachWaitOptions_wait)CLOUD_TYPE_TO_TITLEPRO_CLOUD_URLSget_cloud_type)UAConfig)PRINT_WRAP_WIDTH)entitlement_factory)ApplicabilityStatusUserFacingStatus)notices)Notice)serviceclient)colorize_commandsz=((CVE|cve)-\d{4}-\d{4,7}$|(USN|usn|LSN|lsn)-\d{1,5}-\d{1,2}$)z	cves.jsonzcves/{cve}.jsonznotices.jsonznotices/{notice}.jsonUnfixedPackagepkgunfixed_reasonReleasedPackagesInstallResult
fix_statusunfixed_pkgsinstalled_pkgsall_already_installedBinaryPackageFix
source_pkg
binary_pkgfixed_versionUpgradeResultstatusfailure_reasonc                   @   sZ   e Zd ZdZG dd dZeddZeddZeddZed	d
Ze	dd Z
dd ZdS )	FixStatuszD
    An enum to represent the system status after fix operation
    c                   @   s   e Zd ZeedddZdS )zFixStatus._Valuevaluemsgc                 C   s   || _ || _d S Nr2   )selfr3   r4    r7   3/usr/lib/python3/dist-packages/uaclient/security.py__init__[   s    zFixStatus._Value.__init__N)__name__
__module____qualname__intstrr9   r7   r7   r7   r8   _ValueZ   s   r?   r   Zfixednot-affected   zstill-affected   zaffected-until-rebootc                 C   s   | j j S r5   )r3   r6   r7   r7   r8   	exit_coded   s    zFixStatus.exit_codec                 C   s   | j jS r5   r2   rC   r7   r7   r8   __str__h   s    zFixStatus.__str__N)r:   r;   r<   __doc__r?   SYSTEM_NON_VULNERABLESYSTEM_NOT_AFFECTEDSYSTEM_STILL_VULNERABLESYSTEM_VULNERABLE_UNTIL_REBOOTpropertyrD   rE   r7   r7   r7   r8   r1   U   s   




r1   	FixResultc                       s   e Zd ZdZdZeeef eeef dddZe	j
ejdddgd	d fdd	Zdee ee ee ee ee ee ee eee  ed d	ddZeddddZdee ee ee ee ee ed dddZeddddZ  ZS )UASecurityClient   Zsecurity_url)query_paramsreturnc                 C   s.   | j j di di }|r*|| |S |S )zD
        Update query params with data from feature config.
        Zfeaturesextra_security_params)cfggetupdate)r6   rO   rQ   r7   r7   r8   _get_query_paramsz   s     
z"UASecurityClient._get_query_paramsrA         )Zretry_sleepsNc                    s"   |  |}t j|||||ddS )NF)pathdataheadersmethodrO   Zlog_response_body)rU   superrequest_url)r6   rX   rY   rZ   r[   rO   	__class__r7   r8   r]      s    
zUASecurityClient.request_urlCVE)	queryprioritypackagelimitoffset	componentversionr/   rP   c	              	      sV   ||||||||d}	 j t|	d}
|
jdkrBtjt|
j|
jd fdd|
jD S )znQuery to match multiple-CVEs.

        @return: List of CVE instances based on the the JSON response.
        )qrb   rc   rd   re   rf   rg   r/   rO      urlcodebodyc                    s   g | ]}t  |d qS )clientresponse)r`   ).0Zcve_mdrC   r7   r8   
<listcomp>   s    z-UASecurityClient.get_cves.<locals>.<listcomp>)r]   API_V1_CVESrm   r   SecurityAPIErrorrn   Z	json_list)r6   ra   rb   rc   rd   re   rf   rg   r/   rO   rq   r7   rC   r8   get_cves   s&    

  
zUASecurityClient.get_cves)cve_idrP   c                 C   sB   t j|d}| |}|jdkr4tj||j|jdt| |jdS )zkQuery to match single-CVE.

        @return: CVE instance for JSON response from the Security API.
        cverj   rk   ro   )	API_V1_CVE_TMPLformatr]   rm   r   ru   rn   r`   	json_dict)r6   rw   rl   rq   r7   r7   r8   get_cve   s    

  zUASecurityClient.get_cveUSN)detailsreleaserd   re   orderrP   c                    sf    ||||d}j t|d}|jdkr<tjt|j|jdt fdd|jdg D dd	 d
S )zuQuery to match multiple-USNs.

        @return: Sorted list of USN instances based on the the JSON response.
        )r   r   rd   re   r   ri   rj   rk   c                    s0   g | ](} d ks  | dg krt|dqS )Ncves_idsro   )rS   r~   )rr   Zusn_mdr   r6   r7   r8   rs      s    z0UASecurityClient.get_notices.<locals>.<listcomp>r   c                 S   s   | j S r5   idxr7   r7   r8   <lambda>       z.UASecurityClient.get_notices.<locals>.<lambda>key)	r]   API_V1_NOTICESrm   r   ru   rn   sortedr|   rS   )r6   r   r   rd   re   r   rO   rq   r7   r   r8   get_notices   s&    
  zUASecurityClient.get_notices)	notice_idrP   c                 C   sB   t j|d}| |}|jdkr4tj||j|jdt| |jdS )zbQuery to match single-USN.

        @return: USN instance representing the JSON response.
        )noticerj   rk   ro   )	API_V1_NOTICE_TMPLr{   r]   rm   r   ru   rn   r~   r|   )r6   r   rl   rq   r7   r7   r8   
get_notice   s    

  zUASecurityClient.get_notice)NNNN)NNNNNNNN)NNNNN)r:   r;   r<   Zurl_timeoutZcfg_url_base_attrr   r>   r   rU   r   ZretrysocketZtimeoutr]   r   r=   r   rv   r}   r   r   __classcell__r7   r7   r^   r8   rM   u   sZ   

               
"     !rM   c                   @   s   e Zd ZdZeeef dddZedd Z	edd Z
ed	d
 Zedd Zedd Zedd ZeedddZedd ZdS )CVEPackageStatuszAClass representing specific CVE PackageStatus on an Ubuntu seriescve_responsec                 C   s
   || _ d S r5   rq   )r6   r   r7   r7   r8   r9      s    zCVEPackageStatus.__init__c                 C   s
   | j d S Ndescriptionr   rC   r7   r7   r8   r      s    zCVEPackageStatus.descriptionc                 C   s   | j S r5   )r   rC   r7   r7   r8   r-     s    zCVEPackageStatus.fixed_versionc                 C   s
   | j d S )Npocketr   rC   r7   r7   r8   r     s    zCVEPackageStatus.pocketc                 C   s
   | j d S )Nrelease_codenamer   rC   r7   r7   r8   r   	  s    z!CVEPackageStatus.release_codenamec                 C   s
   | j d S )Nr/   r   rC   r7   r7   r8   r/     s    zCVEPackageStatus.statusc                 C   s   | j dkrtjS | j dkr tjS | j dkr0tjS | j dkr@tjS | j dkrPtjS | j dkr`tjS | j dkrztjj	| j
dS tjj	| j d	S )
NZneededzneeds-triagepending)ignoreddeferredZDNEr@   released)Z
fix_stream)r/   )r/   r   ZSECURITY_CVE_STATUS_NEEDEDZSECURITY_CVE_STATUS_TRIAGEZSECURITY_CVE_STATUS_PENDINGZSECURITY_CVE_STATUS_IGNOREDZSECURITY_CVE_STATUS_DNEZ SECURITY_CVE_STATUS_NOT_AFFECTEDZSECURITY_FIX_RELEASE_STREAMr{   pocket_sourceZSECURITY_CVE_STATUS_UNKNOWNrC   r7   r7   r8   status_message  s"    






zCVEPackageStatus.status_messagerP   c                 C   s   t | jtjkS )z?Return True if the package requires an active Pro subscription.)boolr   r   'SECURITY_UBUNTU_STANDARD_UPDATES_POCKETrC   r7   r7   r8   requires_ua%  s
    zCVEPackageStatus.requires_uac                 C   sR   | j dkrtj}n<| j dkr$tj}n*| j dkr6tj}nd| jkrHtj}ntj}|S )z>Human-readable string representing where the fix is published.	esm-infraesm-apps)ZupdatesZsecurityZesm)r   r   SECURITY_UA_INFRA_POCKETSECURITY_UA_APPS_POCKETr   r-   )r6   Z
fix_sourcer7   r7   r8   r   -  s    



zCVEPackageStatus.pocket_sourceN)r:   r;   r<   rF   r   r>   r   r9   rK   r   r-   r   r   r/   r   r   r   r   r7   r7   r7   r8   r      s$   





r   c                   @   s   e Zd ZdZeeeef dddZe	dddZ
edd	 Zd
d Zeee dddZeed dddZedd Zeeeef dddZdS )r`   z7Class representing CVE response from the SecurityClientro   c                 C   s   || _ || _d S r5   rq   rp   r6   rp   rq   r7   r7   r8   r9   B  s    zCVE.__init__r   c                 C   s   t |tsdS | j|jkS NF)
isinstancer`   rq   r6   otherr7   r7   r8   __eq__F  s    
z
CVE.__eq__c                 C   s   | j dd S )Nr   ZUNKNOWN_CVE_IDrq   rS   upperrC   r7   r7   r8   r   K  s    zCVE.idc                 C   sN   | j }| jD ]}|j} qqdj| j|ddtjjj| jdg}d|S )z2Return a string representing the URL for this cve.{issue}: {title}issuetitle - {}rx   
)	r   r   r   r{   r   r   urlsSECURITY_CVE_PAGEjoin)r6   r   r   linesr7   r7   r8   get_url_headerO  s    
zCVE.get_url_headerc                 C   s   | j dg S )Nnotices_idsrq   rS   rC   r7   r7   r8   r   ^  s    zCVE.notices_idsr~   c                    s<   t  ds6t fdd jdg D dd dd _ jS )	zReturn a list of USN instances from API response 'notices'.

        Cache the value to avoid extra work on multiple calls.
        _noticesc                    s   g | ]}t  j|qS r7   )r~   rp   )rr   r   rC   r7   r8   rs   j  s   zCVE.notices.<locals>.<listcomp>r   c                 S   s   | j S r5   r   nr7   r7   r8   r   n  r   zCVE.notices.<locals>.<lambda>Tr   reverse)hasattrr   rq   rS   r   rC   r7   rC   r8   r   b  s    

zCVE.noticesc                 C   s   | j dS r   r   rC   r7   r7   r8   r   s  s    zCVE.descriptionc                 C   sb   t | dr| jS i | _t j}| jd D ]0}|d D ]"}|d |kr6t|| j|d < q6q*| jS )zDict of package status dicts for the current Ubuntu series.

        Top-level keys are source packages names and each value is a
        CVEPackageStatus object
        _packages_statusZpackagesZstatusesr   name)r   r   r   get_release_infoseriesrq   r   )r6   r   rc   
pkg_statusr7   r7   r8   packages_statusw  s    

zCVE.packages_statusN)r:   r;   r<   rF   rM   r   r>   r   r9   r   r   rK   r   r   r   r   r   r   r   r   r7   r7   r7   r8   r`   ?  s   

r`   c                   @   s   e Zd ZdZeeeef dddZe	dddZ
eeddd	Zeee dd
dZeee dddZedd Zedd Zdd Zeeeeeeeef f f dddZdS )r~   z7Class representing USN response from the SecurityClientro   c                 C   s   || _ || _d S r5   r   r   r7   r7   r8   r9     s    zUSN.__init__r   c                 C   s   t |tsdS | j|jkS r   )r   r~   rq   r   r7   r7   r8   r     s    
z
USN.__eq__c                 C   s   | j dd S )Nr   ZUNKNOWN_USN_IDr   rC   r7   r7   r8   r     s    zUSN.idc                 C   s   | j dg S )z$List of CVE IDs related to this USN.r   r   rC   r7   r7   r8   r     s    zUSN.cves_idsc                    s<   t  ds6t fdd jdg D dd dd _ jS )	zList of CVE instances based on API response 'cves' key.

        Cache the values to avoid extra work for multiple call-sites.
        _cvesc                    s   g | ]}t  j|qS r7   )r`   rp   )rr   ry   rC   r7   r8   rs     s   zUSN.cves.<locals>.<listcomp>cvesc                 S   s   | j S r5   r   r   r7   r7   r8   r     r   zUSN.cves.<locals>.<lambda>Tr   )r   r   rq   rS   r   rC   r7   rC   r8   r     s    

zUSN.cvesc                 C   s   | j dS )Nr   r   rC   r7   r7   r8   r     s    z	USN.titlec                 C   s   | j dS )N
referencesr   rC   r7   r7   r8   r     s    zUSN.referencesc                 C   s   dj | j| jdg}| jrN|d | jD ] }|d tjjj |d q*n*| jrx|d | jD ]}|d|  qdd	|S )	z5Return a string representing the URL for this notice.r   r   zFound CVEs:r   rx   zFound Launchpad bugs:z - r   )
r{   r   r   r   appendr   r   r   r   r   )r6   r   ry   Z	referencer7   r7   r8   r     s    



zUSN.get_url_headerc                 C   sV  t | dr| jS t j}i | _| jdi |g D ]}|dr|d | jkrd| j|d  krtjdj	| j
|d d| j
dd	|| j|d  d< nd|i| j|d < q6|d
stjdj	| j
|d d| j
dd	n6d|d
 krtjdj	| j
|d |d
 d| j
dd	|d
 dd }|| jkr<i | j|< || j| |d < q6| jS )aW  Binary package information available for this release.


        Reformat the USN.release_packages response to key it based on source
        package name and related binary package names.

        :return: Dict keyed by source package name. The second-level key will
            be binary package names generated from that source package and the
            values will be the dict response from USN.release_packages for
            that binary package. The binary metadata contains the following
            keys: name, version.
            Optional additional keys: pocket and component.
        _release_packagesrelease_packagesZ	is_sourcer   sourcez6{usn} metadata defines duplicate source packages {pkg})usnr#    Z	error_msgr   
extra_infoZsource_linkzL{issue} metadata does not define release_packages source_link for {bin_pkg}.)r   bin_pkg/zX{issue} metadata has unexpected release_packages source_link value for {bin_pkg}: {link})r   r   link)r   r   r   r   r   rq   rS   r   SecurityAPIMetadataErrorr{   r   split)r6   r   r#   source_pkg_namer7   r7   r8   r     sZ    


 
 
zUSN.release_packagesN)r:   r;   r<   rF   rM   r   r>   r   r9   r   r   rK   r   r   r   r`   r   r   r   r   r   r7   r7   r7   r8   r~     s    

r~   r   c            	      C   s|   d} t dd|  d dg\}}i }| D ]J}|d\}}}}|sJ|}d|krTq,||krj||| |< q,||i||< q,|S )zReturn a dict of all source packages installed on the system.

    The dict keys will be source package name: "krb5". The value will be a dict
    with keys binary_pkg and version.
    z${db:Status-Status}z
dpkg-queryz#-f=${Package},${Source},${Version},r   z-W,Z	installed)r   Zsubp
splitlinesr   )	Zstatus_fieldoutZ_errinstalled_packagesZpkg_linepkg_namer   Zpkg_versionr/   r7   r7   r8   #query_installed_source_pkg_versions  s$    
r   )usnsbeta_pocketsrP   c                    s   i }| D ]}|j  D ]\}} fdd| D }||krJ|rJ|||< q||kr|| }| D ]F\}}	||kr||	||< qb|| d }
|	d }t||
dkrb|	||< qbqq|S )a  Walk related USNs, merging the released binary package versions.

    For each USN, iterate over release_packages to collect released binary
        package names and required fix version. If multiple related USNs
        require different version fixes to the same binary package, track the
        maximum version required across all USNs.

    :param usns: List of USN response instances from which to calculate merge.
    :param beta_pockets: Dict keyed on service name: esm-infra, esm-apps
        the values of which will be true of USN response instances
        from which to calculate merge.

    :return: Dict keyed by source package name. Under each source package will
        be a dict with binary package name as keys and binary package metadata
        as the value.
    c              	      s.   i | ]&\}}d   | ddd kr||qS )Fr   NonerS   )rr   Zbin_pkg_nameZ
bin_pkg_mdr   r7   r8   
<dictcomp>F  s    z>merge_usn_released_binary_package_versions.<locals>.<dictcomp>rg   r   )r   itemsr   version_compare)r   r   Zusn_pkg_versionsr   src_pkgZbinary_pkg_versionsZpublic_bin_pkg_versionsZusn_src_pkgr   Zbinary_pkg_mdZprev_versionZcurrent_versionr7   r   r8   *merge_usn_released_binary_package_versions/  s*    



r   c                 C   sn   | j s
g S i }| j D ]@}|jD ]4}|ds.q|| jkr:q||kr|j|d||< qqtt| dd dS )zFor a give usn, get the related USNs for it.

    For each CVE associated with the given USN, we capture
    other USNs that are related to the CVE. We consider those
    USNs related to the original USN.
    zUSN-r   c                 S   s   | j S r5   r   r   r7   r7   r8   r   |  r   z"get_related_usns.<locals>.<lambda>r   )r   r   
startswithr   r   listr   values)r   rp   related_usnsry   Zrelated_usn_idr7   r7   r8   get_related_usnsa  s    




r   )issue_idrP   c                 C   sf   t  }|d k	rb|j d k	rb|j jd k	rb|j jD ]2}|j|  kr.|jr.|j jpPd}tj|f  S q.dS )NzN/A)NN)	r   r/   fixesr   lowerZpatchedrg   r1   rG   )r   Z	lp_statusZfixrg   r7   r7   r8   _check_cve_fixed_by_livepatch  s    
r   )ry   r   r   r   rR   r   dry_runrP   c           	      C   s2   t | |d}t||}t  t||||||djS )N)ry   r   rR   r   affected_pkg_statusr   usn_released_pkgsr   )'get_cve_affected_source_packages_statusr   printprompt_for_affected_packagesr/   )	ry   r   r   r   rR   r   r   r   r   r7   r7   r8   _fix_cve  s"    	  r   )	r   r   r   r   rR   r   r   
no_relatedrP   c              	   C   s  t dtjj|d  t| |d}t| g|}	t|||||	|d\}
}|
tjtj	fkrZ|
S |rb|rf|
S t dtj
jddd |D d  t dtj  i }|D ]R}t d	|j t||d}t|g|}	t||j|||	|d}|||j< t   qt tj t|
|tjd
 d}|D ]}||j j}t||jtjd
 |tjkr`t dtjjdd  d}|tjkr||j jp|g }|D ]"}|jrt d|j|j qd}q|rt dtjj|d  |
S )Nr   r   r   r   r   z
- c                 s   s   | ]}|j V  qd S r5   r   )rr   r   r7   r7   r8   	<genexpr>  s     z_fix_usn.<locals>.<genexpr>)r   z- {})contextF- fix operationZ	operationTz
  - {}: {})r   r   ZSECURITY_FIXING_REQUESTED_USNr{   get_affected_packages_from_usnr   r   r1   rG   rH   ZSECURITY_RELATED_USNSr   ZSECURITY_FIXING_RELATED_USNSr   ZSECURITY_USN_SUMMARY_handle_fix_status_messageZFIX_ISSUE_CONTEXT_REQUESTEDr/   ZFIX_ISSUE_CONTEXT_RELATEDrJ   ENABLE_REBOOT_REQUIRED_TMPLrI   r'   r$   r#   ZSECURITY_RELATED_USN_ERROR)r   r   r   r   rR   r   r   r  r   r   Ztarget_fix_status_Zrelated_usn_statusZrelated_usnZrelated_fix_statusZfailure_on_related_usnr/   r'   Zunfixed_pkgr7   r7   r8   _fix_usn  s      
	  	

   r  F)rR   r   r   r  rP   c              
   C   s  |rt tj | }t| d}t }ttj| ttj| d}d|krt	|\}}|rpt tj
j||d |S z|j|d}	|j|d}
W n> tjk
r } z|jdkrtj|d|W 5 d }~X Y nX t |	  t|	|
||| ||d	S z|j|d
}t||}
W nB tjk
rJ } z |jdkr6tj|d|W 5 d }~X Y nX t |  |jd sztjd||ddt||
||| |||dS d S )NrR   )r   r   r`   )r   rg   )rw   )r   i  r  )ry   r   r   r   rR   r   r   r   r   z.{} metadata defines no fixed package versions.r   r   )r   r   r   r   rR   r   r   r  )r   r   ZSECURITY_DRY_RUN_WARNINGr   rM   r   _is_pocket_used_by_beta_servicer   r   r   ZCVE_FIXED_BY_LIVEPATCHr{   r}   r   r   ru   rm   ZSecurityIssueNotFoundr   r   r   r   rq   r   r  )rR   r   r   r  rp   r   r   Zlivepatch_cve_statusZpatch_versionry   r   er   r7   r7   r8   fix_security_issue_id  s    

  	
r  c                 C   s`   i }| D ]R}t || D ]>\}}||kr4|||< q|| j}t||jdkr|||< qq|S )Nr   )r   r   r-   r   r   )r   r   affected_pkgsry   r   r   Zcurrent_verr7   r7   r8   get_affected_packages_from_cvesv  s     

r  c                 C   s   i }| j  D ]l\}}||kr qtt}d|d< dd | D }|s`tjd| j| jdd| |d< t	|d	||< q|S )
Nr   r/   c                 S   s"   h | ]\}}| d r|d  qS )r   r   )rr   r  Zpkg_bin_infor7   r7   r8   	<setcomp>  s   
z1get_affected_packages_from_usn.<locals>.<setcomp>zC{} metadata defines no pocket information for any release packages.r   r   r   r   )
r   r   r   r>   r   r   r{   r   popr   )r   r   r  r   Zpkg_infor   Zall_pocketsr7   r7   r8   r	    s*    r	  )r   r   rP   c                 C   s    | j rt| j |S t| |S dS )zWalk CVEs related to a USN and return a dict of all affected packages.

    :return: Dict keyed on source package name, with active CVEPackageStatus
        for the current Ubuntu release.
    N)r   r  r	  r  r7   r7   r8    get_usn_affected_packages_status  s    r  )ry   r   rP   c                 C   s8   i }| j  D ]$\}}|jdkr"q||kr|||< q|S )zGet a dict of any CVEPackageStatuses affecting this Ubuntu release.

    :return: Dict of active CVEPackageStatus keyed by source package names.
    r@   )r   r   r/   )ry   r   Zaffected_pkg_versionsr+   Zpackage_statusr7   r7   r8   r     s    

r   )r   r   c                 C   st   t |}|dkr6ttj tdtjj| dd  dS tj|j|dt	|
 d}ttj|tdd	d
 dS )a	  Print header strings describing affected packages related to a CVE/USN.

    :param issue_id: String of USN or CVE issue id.
    :param affected_pkg_status: Dict keyed on source package name, with active
        CVEPackageStatus for the current Ubuntu release.
    r   r   r   )r   r   N, )countpkgs    F)widthsubsequent_indentZreplace_whitespace)lenr   r   ZSECURITY_NO_AFFECTED_PKGSSECURITY_ISSUE_UNAFFECTEDr{   ZSECURITY_AFFECTED_PKGS	pluralizer   r   keystextwrapfillr   )r   r   r  r4   r7   r7   r8   print_affected_packages_header  s0    	
  r#  )r   usn_src_released_pkgsrP   c                 C   sf   t | }|rb|drbd|jd< |d d |jd< | D ]$\}}|d}|r<||jd<  qbq<|S )a  Parse release status based on both pkg_status and USN.release_packages.

    Since some source packages in universe are not represented in
    CVEPackageStatus, rely on presence of such source packages in
    usn_src_released_pkgs to represent package as a "released" status.

    :param pkg_status: the CVEPackageStatus for this source package.
    :param usn_src_released_pkgs: The USN.release_packages representing only
       this source package. Normally, release_packages would have data on
       multiple source packages.

    :return: Tuple of:
        human-readable status message, boolean whether released,
        boolean whether the fix requires access to UA
    r   r   r/   rg   r   r   )copydeepcopyrS   rq   r   )r   r$  usn_pkg_statusr   Zusn_released_pkgr   r7   r7   r8   #override_usn_release_package_status  s    




r(  c                 C   sd   i }t |  D ]N\}}||i }t||}|jdd}||krLg ||< || ||f q|S )Nr   r   )r   r   rS   r(  r/   replacer   )r   r   Zstatus_groupsr   r   usn_released_srcr'  Zstatus_groupr7   r7   r8   group_by_usn_package_status  s     r+  )pkg_status_list	pkg_indexnum_pkgsrP   c                 C   s   | sdS g }g }| D ],\}}|d7 }| d|| | | qtjddd| d dt|tdd	}d
||jS )z;Format the packages and status to an user friendly message.r   rA   z{}/{}z{} {}:(r  )r  r  r  z{}
{})r   r{   r!  r"  r   r   r   r   )r,  r-  r.  Z	msg_indexZsrc_pkgsr   r   Z
msg_headerr7   r7   r8   _format_packages_message  s"     r2  )r   rR   c                 C   s>   d}| t jkrd}n| t jkr"d}t||d}|r:||S d S )Nzno-service-neededr   r   )rR   r   )r   r   r   r   )r   rR   Zservice_to_checkZent_clsr7   r7   r8   _get_service_for_pocket3  s    

r3  )r   rR   rP   c                 C   s4   t | |}|r0| \}}|tjkr(dS |j S dS )zBCheck if the pocket where the fix is at belongs to a beta service.F)r3  user_facing_statusr   ACTIVEZvalid_service)r   rR   ent
ent_statusr  r7   r7   r8   r  >  s    

r  r   )r/   r   r  c                 C   s   | t jkr>|r tjj||d}ntjj|d}tt| n| t j	kr||r^tj
j||d}ntjj|d}tt| np| t jkr|rtjj||d}ntjj|d}tt| n2|rtjj||d}ntjj|d}tt| d S )N)r   r  )r   )r1   rG   r   Z%SECURITY_ISSUE_RESOLVED_ISSUE_CONTEXTr{   ZSECURITY_ISSUE_RESOLVEDr   r   Zhandle_unicode_charactersrH   Z'SECURITY_ISSUE_UNAFFECTED_ISSUE_CONTEXTr  rJ   Z)SECURITY_ISSUE_NOT_RESOLVED_ISSUE_CONTEXTZSECURITY_ISSUE_NOT_RESOLVED)r/   r   r  r4   r7   r7   r8   r
  N  s>    
 
 
  r
  )rR   src_pocket_pkgsbinary_pocket_pkgsr-  r.  r   rP   c                    s~  d}d}g }t  }	|rntjtjtjfD ]B}
||
 }||
 }tjj|
d |r8t|||d}|rt| |s~ttj	 q(nd}g }t
|D ]v}|
tjk}tj|j|d}|rt|j|dkr||j qtjj|j|jd}td|  |t|j|d	 q|t|7 }t| ||
|d
}||jM }|jp6d |sX| fdd|D  q(|	dd |D  q(t|||	|dS )a%  Handle the packages that could be fixed and have a released status.

    :returns: Tuple of
        boolean whether all packages were successfully upgraded,
        list of strings containing the packages that were not upgraded,
        boolean whether all packages were already installed
    Tservicer,  r-  r.  F)check_esm_cacher   )rc   rg   r  r#   r$   )rR   upgrade_pkgsr   r   r   c                    s   g | ]\}}t | d qS r>  r"   rr   r   r  Zfailure_msgr7   r8   rs     s
   z2_handle_released_package_fixes.<locals>.<listcomp>c                 s   s   | ]}|j V  qd S r5   )r,   )rr   r,   r7   r7   r8   r    s    z1_handle_released_package_fixes.<locals>.<genexpr>)r&   r'   r(   r)   )setr   r   r   r   SECURITY_UA_SERVICE_REQUIREDr{   r2  r   ZSECURITY_UPDATE_INSTALLEDr   r   Zget_pkg_candidate_versionr,   r   r-   r   ZFIX_CANNOT_INSTALL_PACKAGEr"   r+   r  upgrade_packages_and_attachr/   r0   extendrT   r%   )rR   r8  r9  r-  r.  r   r)   Zupgrade_statusr'   r(   r   Zpkg_src_groupZbinary_pkgsr4   r?  r,   r=  Zcandidate_versionr$   Zupgrade_resultr7   rC  r8   _handle_released_package_fixess  s    

  




rH  )r'   rP   c                 C   sB   t dd | D }t|}tjtj|j|d|dt	ddS )zFormat the list of unfixed packages into an message.

    :returns: A string containing the message output for the unfixed
              packages.
    c                 S   s   h | ]
}|j qS r7   )r#   )rr   r#   r7   r7   r8   r    s     z/_format_unfixed_packages_msg.<locals>.<setcomp>r  )r.  r  r  r1  )
r   r  r!  r"  r   ZSECURITY_PKG_STILL_AFFECTEDr  r{   r   r   )r'   Zsorted_pkgsZnum_pkgs_unfixedr7   r7   r8   _format_unfixed_packages_msg  s    rI  )rR   r   r   r   r   r   rP   c              
      s  t |}t|| |dkr(ttjddS tt}tt}d}	t||}
g }t|
	 D ]\}}|dkrtj
}tt||	|d |	t |7 }	|d d j | fdd|D 7 }qV|D ]\}}||j ||f || 	 D ]\\}}||i }||krq||i d	d
}t||dkr||j t|||d qqqVt| |||	||d}||j7 }t  |rttt| |jr|jr|rtjntj
}n\tj|jdrtjjdd}t| t j!t"j#dd |rtjntj$}n|rtjntj
}ntj}t%|| t||dS )a  Process security CVE dict returning a CVEStatus object.

    Since CVEs point to a USN if active, get_notice may be called to fill in
    CVE title details.

    :returns: An FixStatus enum value corresponding to the system state
              after processing the affected packages
    r   N)r/   r'   r   r<  rA   c                    s   g | ]\}}t | d qS r@  rA  rB  Z
status_msgr7   r8   rs   %  s   z0prompt_for_affected_packages.<locals>.<listcomp>rg   r   )r+   r,   r-   )rR   r8  r9  r-  r.  r   )r(   r  r  )&r  r#  rL   r1   rH   r   r   r+  r   r   rG   r   r2  r   r   r   rS   r   r   r*   rH  r'   rI  r&   r)   rI   r   Zshould_rebootr(   r   r  r{   r   addr   ZENABLE_REBOOT_REQUIREDrJ   r
  )rR   r   r   r   r   r   r  r8  r9  r-  Zpkg_status_groupsr'   Zstatus_valueZpkg_status_groupZ
fix_resultr   r   r,   rg   r*  r-   Zreleased_pkgs_install_resultZ
reboot_msgr7   rJ  r8   r     s    
  

 

	





r   c                  C   s6   t  \} }| tkr2ttjjt| t| d dS )z:Alert the user when running Pro on cloud with PRO support.)r   Zcloud_specific_urlN)r   r   r   r   ZSECURITY_USE_PRO_TMPLr{   r   rS   )Z
cloud_typer  r7   r7   r8   *_inform_ubuntu_pro_existence_if_applicable  s    
rL  )rR   tokenrP   c              
   C   s   ddl }ddlm} ttdd|gg z$||j|dddd| }|dkW S  tjk
r } zt|j	 W Y d	S d}~X Y nX dS )
ztAttach to an Ubuntu Pro subscription with a given token.

    :return: True if attach performed without errors.
    r   NcliproZattachTrO  )rM  Zauto_enabler{   Zattach_configF)
argparseuaclientrO  r   r!   Zaction_attach	Namespacer   ZUbuntuProErrorr4   )rR   rM  rQ  rO  Zret_codeerrr7   r7   r8   _run_ua_attach  s"       

rU  r  c              
   C   s   t tj t| d}t dtjj|jd  t|jd}zt	|| d}W nJ t
jk
r } z*t tj t|jd}t|| d |W 5 d }~X Y nX t dtj  t| |jS )Nr  r   )	user_code)Zmagic_token)ZoptionsrR   )r   r   ZCLI_MAGIC_ATTACH_INITr   ZCLI_MAGIC_ATTACH_SIGN_INr{   rV  r   rM  r   r   ZMagicAttachTokenErrorZCLI_MAGIC_ATTACH_FAILEDr   r   ZCLI_MAGIC_ATTACH_PROCESSINGrU  Zcontract_token)rR   Zinitiate_respZwait_optionsZ	wait_respr  Zrevoke_optionsr7   r7   r8   _perform_magic_attach  s*    


rW  )rR   rP   c                 C   sj   t   ttj tjtjdddgd}|dkr2dS |dkrBt| S |dkrfttj t	d}t
| |S dS )zZPrompt for attach to a subscription or token.

    :return: True if attach performed.
    sacZvalid_choicesF> T)rL  r   r   Z*SECURITY_UPDATE_NOT_INSTALLED_SUBSCRIPTIONr   prompt_choicesZSECURITY_FIX_ATTACH_PROMPTrW  ZPROMPT_ENTER_TOKENinputrU  )rR   choicerM  r7   r7   r8   _prompt_for_attach  s    


r`  )rR   r;  rP   c                 C   s   ddl }ddlm} ttjj|d tjtj	j|dddgd}|dkrtt
dd	|gg td||j|gd
dddd| kS dS )zMPrompt for enable a pro service.

    :return: True if enable performed.
    r   NrN  r:  r  rZ  r[  rP  enableTFrO  )r;  
assume_yesZbetar{   Zaccess_only)rQ  rR  rO  r   r   ZSECURITY_SERVICE_DISABLEDr{   r   r]  ZSECURITY_FIX_ENABLE_PROMPTr!   r   Zaction_enablerS  )rR   r;  rQ  rO  r_  r7   r7   r8   _prompt_for_enable  s0    rc  )rR   r   rP   c                 C   s   |rt dtj  dS t| S )z<Verify if machine is attached to an Ubuntu Pro subscription.r   T)r   r   Z SECURITY_DRY_RUN_UA_NOT_ATTACHEDr`  )rR   r   r7   r7   r8   _check_attached  s    rd  )r   rR   r   rP   c                 C   s   t | |}|r| \}}|tjkr(dS | \}}|tjkr|r^tdtj	j
|jd  dS t||jrndS ttjj
|jd nttjj
|jd dS )zQ
    Verify if the Ubuntu Pro subscription has the required service enabled.
    Tr   r:  F)r3  r4  r   r5  applicability_statusr   Z
APPLICABLEr   r   Z'SECURITY_DRY_RUN_UA_SERVICE_NOT_ENABLEDr{   r   rc  ZSECURITY_UA_SERVICE_NOT_ENABLEDZ SECURITY_UA_SERVICE_NOT_ENTITLED)r   rR   r   r6  r7  r  re  r7   r7   r8   (_check_subscription_for_required_service  s:    


rf  c                 C   s   ddl }ddlm} t  ttj tjtj	ddgd}|dkrttj
 td}ttdd	gg ||jd
dd|  t| |S dS )zdPrompt for attach a new subscription token to the user.

    :return: True if attach performed.
    r   NrN  rrZ  r[  r\  rP  detachTrO  )rb  r{   F)rQ  rR  rO  rL  r   r   Z%SECURITY_UPDATE_NOT_INSTALLED_EXPIREDr   r]  ZSECURITY_FIX_RENEW_PROMPTZPROMPT_EXPIRED_ENTER_TOKENr^  r!   Zaction_detachrS  rU  )rR   rQ  rO  r_  rM  r7   r7   r8   _prompt_for_new_token)  s$    

 
ri  )status_cacherR   r   rP   c                 C   sV   |  dd}|sdS |  d}|dks6|t|jk rR|rHttj dS t| S dS )zuCheck if the Ubuntu Pro subscription is expired.

    :returns: True if subscription is expired and not renewed.
    attachedFZexpiresN)rS   r   ZnowZtzinfor   r   Z(SECURITY_DRY_RUN_UA_EXPIRED_SUBSCRIPTIONri  )rj  rR   r   rk  Zcontract_expiry_datetimer7   r7   r8   _check_subscription_is_expiredD  s    



rl  )rR   r?  r   r   rP   c              
   C   sz  |st dddS t s6|s6tj}t| t d|dS |tjkr| dpLi }|dds|t	| |st dtj
j|ddS n$t|| |drt dtjj|ddS t|| |st dtjj|ddS ttd	d
dgd	dddg t| g |snz*t  tjddddg| ddid W nR tk
rl } z2t|dt|}t|  t dtjd W Y S d}~X Y nX t dddS )a  Upgrade available packages to fix a CVE.

    Upgrade all packages in upgrades_packages and, if necessary,
    prompt regarding system attach prior to upgrading Ubuntu Pro packages.

    :return: True if package upgrade completed or unneeded, False otherwise.
    TN)r/   r0   Fzstatus-cacherk  r:  )rj  rR   r   r   rT   z&&installz--only-upgradez-yzapt-getZDEBIAN_FRONTENDZnoninteractive)cmdZoverride_env_varsr4   )r.   r   Zwe_are_currently_rootr   ZSECURITY_APT_NON_ROOTr   r   Z
read_cacherS   rd  rE  r{   rl  Z$SECURITY_UA_SERVICE_WITH_EXPIRED_SUBrf  Z%SECURITY_UA_SERVICE_NOT_ENABLED_SHORTr!   r   r   Zrun_apt_update_commandZrun_apt_command	Exceptiongetattrr>   stripZSECURITY_UA_APT_FAILURE)rR   r?  r   r   r4   rj  r  r7   r7   r8   rF  ^  sz    


  



 rF  )FF)r   )fr%  enumr   r!  collectionsr   r   typingr   r   r   r   r   r	   r
   rR  r   r   r   r   r   r   Z+uaclient.api.u.pro.attach.magic.initiate.v1r   Z)uaclient.api.u.pro.attach.magic.revoke.v1r   r   Z'uaclient.api.u.pro.attach.magic.wait.v1r   r   Zuaclient.clouds.identityr   r   r   Zuaclient.configr   Zuaclient.defaultsr   Zuaclient.entitlementsr   Z(uaclient.entitlements.entitlement_statusr   r   Zuaclient.filesr   Zuaclient.files.noticesr   Zuaclient.httpr    Zuaclient.statusr!   ZCVE_OR_USN_REGEXrt   rz   r   r   r>   r"   r   r%   r*   r.   Enumr1   rL   ZUAServiceClientrM   r   r`   r~   r   r   r   r   r   r  r  r  r	  r  r   r#  r(  r+  r=   r2  r3  r  r
  rH  rI  r   rL  rU  rW  r`  rc  rd  rf  ri  rl  rF  r7   r7   r7   r8   <module>   s\  $ 	



		 HL  
2

t  Y  
 
 
"#   &s
 "	  +
     